Guide to Operational Technology (OT) security

Probably not a substantial claim: may not pass S3 (load-bearing).

A DCS uses a centralized supervisory control loop to mediate a group of localized controllers that share the overall tasks of carrying out an entire production process.

“A DCS uses a centralized supervisory control loop to mediate a group of localized controllers that share the overall tasks of carrying out an entire production process [Erickson].”

• cites EricksonNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

This integration supports new IT capabilities but provides significantly less isolation for OT from the outside world than predecessor systems, creating a greater need to secure them.

“This integration supports new IT capabilities but provides significantly less isolation for OT from the outside world than predecessor systems, creating a greater need to secure them.”

Probably not a substantial claim: may not pass S2 (checkable).

The operational and risk differences between IT and OT systems create the need for increased sophistication in applying cybersecurity and operational strategies.

“In summary, the operational and risk differences between IT and OT systems create the need for increased sophistication in applying cybersecurity and operational strategies.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

By modularizing the production system, a DCS reduces the impact of a single fault on the overall system.

“By modularizing the production system, a DCS reduces the impact of a single fault on the overall system.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Standard industrial communication protocols designed by industry groups such as Modbus and Fieldbus are often used on control networks and fieldbus networks.

“Standard industrial communication protocols designed by industry groups such as Modbus and Fieldbus [Berge] are often used on control networks and fieldbus networks.”

• cites BergeNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Widely available and low-cost Ethernet, Internet Protocol (IP), and wireless devices are now replacing older proprietary technologies, which increases the likelihood of cybersecurity vulnerabilities and incidents.

“Widely available and low-cost Ethernet, Internet Protocol (IP), and wireless devices are now replacing older proprietary technologies, which increases the likelihood of cybersecurity vulnerabilities and incidents.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The IIoT consists of sensors, instruments, machines, and other devices that are networked together and use internet connectivity to enhance industrial and manufacturing business processes and applications.

“The Industrial Internet of Things (IIoT) consists of sensors, instruments, machines, and other devices that are networked together and use internet connectivity to enhance industrial and manufacturing business processes and applications [Berge].”

• cites BergeNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

While an ICSS combines the functionality of both control and safety systems, the SIS must still comply with the requirements outlined in IEC61511.

“While an ICSS combines the functionality of both control and safety systems, the SIS must still comply with the requirements outlined in [IEC61511].”

• cites IEC61511Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

An SIS is specifically designed in accordance with IEC61511.

“Although numerous other terms are associated with safety systems, the SIS is specifically designed in accordance with [IEC61511].”

• cites IEC61511Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A fieldbus allows for greater functionality beyond control, including field device diagnostics, and can accomplish control algorithms within the fieldbus, thereby avoiding signal routing back to the PLC for every control operation.

“Additionally, a fieldbus allows for greater functionality beyond control, including field device diagnostics, and can accomplish control algorithms within the fieldbus, thereby avoiding signal routing back to the PLC for every control operation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Industry IoT Consortium proposes a three-tier system architecture model for representing IIoT systems: the edge tier, platform tier, and enterprise tier.

“The Industry IoT Consortium proposes a three-tier system architecture model for representing IIoT systems [IIRA19]: the edge tier, platform tier, and enterprise tier.”

• cites IIRA19Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

OT systems tend to prioritize availability and safety over other factors like confidentiality.

“For example, OT systems tend to prioritize availability and safety over other factors like confidentiality.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

For an OT system, available risk responses may be constrained by system requirements, potential adverse impacts on operations, or regulatory compliance regimes.

“For an OT system, available risk responses may be constrained by system requirements, potential adverse impacts on operations, or even regulatory compliance regimes.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

A strong OT cybersecurity program is fundamental to a sustainable business operation and can potentially enhance system reliability and availability.

“A strong OT cybersecurity program is fundamental to a sustainable business operation and can potentially enhance system reliability and availability.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Analog control systems may prevent the physical process from entering an undesired state when the digital OT system is unavailable or corrupted.

“These may prevent the physical process from entering an undesired state when the digital OT system is unavailable or corrupted.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Assessing risk requires identifying threats and vulnerabilities, the harm that such threats and vulnerabilities may cause, and the likelihood that adverse events may arise from those threats and vulnerabilities.

“Regardless of which risk management level the risk assessment is conducted at, assessing risk requires identifying threats and vulnerabilities, the harm that such threats and vulnerabilities may cause, and the likelihood that adverse events may arise from those threats and vulnerabilities.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Manual control mechanisms ensure that an actuator can be controlled even if the OT system is unavailable or compromised.

“This ensures that an actuator can be controlled even if the OT system is unavailable or compromised.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

A cybersecurity program that has commitment from senior management is more likely to achieve the mission and business goals of the organization.

“A cybersecurity program that has commitment from senior management is more likely to achieve the mission and business goals of the organization.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The activities in the monitoring component impact all of the other components of risk management.

“The activities in the monitoring component impact all of the other components.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

The cultures of control engineering and IT are often significantly different.

“As the cultures of control engineering and IT are often significantly different”

Probably not a substantial claim: may not pass S3 (load-bearing).

Non-digital control mechanisms may require additional time and human involvement.

“For example, non-digital control mechanisms may require additional time and human involvement, such as operators travelling to a remote site to perform certain control functions.”

Probably not a substantial claim: may not pass S4 (based).

As OT systems are increasingly being connected to IT networks, relying on traditional measures (e.g., air gaps) is not enough to protect such systems from cyber attacks.

“As OT systems are increasingly being connected to IT networks, relying on traditional measures (e.g., air gaps) is not enough to protect such systems from cyber attacks.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Supply chain risk management and risk management for safety are critical aspects of OT cybersecurity risk management.

“Supply chain risk management and risk management for safety are critical aspects of OT cybersecurity risk management.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

NIST PRAM is a tool that applies the risk model from NIST IR 8062 and helps organizations analyze, assess, and prioritize privacy risks.

“The NIST Privacy Risk Assessment Methodology (PRAM) is a tool that applies the risk model from NIST IR 8062 [IR8062] and helps organizations analyze, assess, and prioritize privacy risks to determine how to respond and select appropriate solutions.”

• cites IR8062Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Risk assessments require reviewing the digital and non-digital mechanisms that are implemented to minimize adverse event impacts.

“Risk assessments also require reviewing the digital and non-digital mechanisms that are implemented to minimize adverse event impacts.”

Probably not a substantial claim: may not pass S4 (based).

OT systems operate under different environments and requirements than IT systems.

“OT systems operate under different environments and requirements than IT systems.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Cybersecurity is another threat to the safety and reliability of industrial processes.

“Cybersecurity is another threat to the safety and reliability of industrial processes”

Probably not a substantial claim: may not pass S4 (based).

IT programs or tools may not be suitable or effective for OT systems.

“IT programs or tools may not be suitable or effective for OT systems.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Passive monitoring may not always capture all modifications to the system.

“However, this may not always capture all modifications to the system.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Analog control systems use non-digital sensors and actuators to monitor and control a physical process.

“Analog control systems use non-digital sensors and actuators to monitor and control a physical process.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Risk assessments occur at all risk management levels and can be used to inform risk assessments at other levels.

“Risk assessments occur at all risk management levels (i.e., organization, mission and business function, and system) and can be used to inform risk assessments at other levels.”

Probably not a substantial claim: may not pass S4 (based).

A cybersecurity incident on an OT system may have catastrophic consequences that affect human life and the environment.

“Protecting OT systems is critical, and a cybersecurity incident on an OT system may have catastrophic consequences that affect human life and the environment.”

Classified as probably not a substantial claim.

An OT environment prioritizes safety, followed by availability, integrity, and confidentiality.

“which instead prioritizes safety, followed by availability, integrity, and confidentiality.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Threat information as it relates to the OT environment is evolving, and the availability and accuracy of this threat information is early in its development.

“Threat information as it relates to the OT environment is evolving, and the availability and accuracy of this threat information is early in its development.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

IT often has years of cybersecurity experience, much of which is applicable to OT.

“IT often has years of cybersecurity experience, much of which is applicable to OT.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For other-than-adversarial threat events, the likelihood of occurrence is estimated using historical evidence, empirical data, and other factors.

“For other-than-adversarial threat events, the likelihood of occurrence is estimated using historical evidence, empirical data, and other factors.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Risk assessments are typically point-in-time reports.

“Risk assessments are typically point-in-time reports.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Cybersecurity events could potentially impact the organization's mission and objectives, the environment, regulatory compliance, and even human safety.

“Cybersecurity events could potentially impact the organization's mission and objectives, the environment, regulatory compliance, and even human safety.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Including safety experts as part of the cybersecurity team will be beneficial in identifying potential impact areas due to cyber vulnerabilities.

“including safety experts as part of the cybersecurity team will be beneficial in identifying potential impact areas due to cyber vulnerabilities.”

Probably not a substantial claim: may not pass S2 (checkable).

Therefore, security measures tailored to the OT system are required to protect the organization.

“Therefore, security measures tailored to the OT system are required to protect the organization.”

Probably not a substantial claim: may not pass S4 (based).

Risk to operations exists because of the potential of threat actors exploiting the vulnerabilities in the applications and infrastructures.

“Risk to operations exists because of the potential of threat actors exploiting the vulnerabilities in the applications and infrastructures.”

Classified as probably not a substantial claim.

Control engineers will not be able to secure OT without collaboration and support from both the IT department and management.

“While the control engineers will play a large role in securing OT, they will not be able to do so without collaboration and support from both the IT department and management.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For adversarial threats, an assessment of likelihood of occurrence is typically based on adversary intent, capability, and targeting.

“For adversarial threats, an assessment of likelihood of occurrence is typically based on adversary intent, capability, and targeting.”

Classified as probably not a substantial claim.

In OT contexts, the potential for damage to equipment, human safety, the natural environment, and other critical infrastructures is part of risk considerations.

“In the context of OT, the potential for damage to equipment, human safety, the natural environment, and other critical infrastructures is part of these considerations.”

Classified as probably not a substantial claim.

The primary purpose of investing in a cybersecurity program is risk management.

“The primary purpose of investing in a cybersecurity program is risk management.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Since new OT systems are designed and deployed less frequently than IT systems, it is much more common to improve, expand, or update an existing OT system than to design a new one.

“Since new OT systems are designed and deployed less frequently than IT systems, it is much more common to improve, expand, or update an existing OT system than to design a new one.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The impact of a cyber incident on an OT may include both physical and digital effects.

“For example, the impact of a cyber incident on an OT may include both physical and digital effects.”

Probably not a substantial claim: may not pass S2 (checkable).

The most appropriate decision regarding what to include in the scope of a cybersecurity program can be made if investments are viewed through the lens of corporate risk management.

“Therefore, the most appropriate decision regarding what to include in the scope of a cybersecurity program can be made if investments are viewed through the lens of corporate risk management.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Often OT systems are implemented with an undefined frequency for monitoring cyber activities.

“Often OT systems are implemented with an undefined frequency for monitoring cyber activities.”

Classified as probably not a substantial claim.

Deploying systems to the field based on the assumption that these systems will be secured later introduces significant risks to the systems and the organization.

“Deploying systems to the field based on the assumption that these systems will be secured later introduces significant risks to the systems and the organization.”

Probably not a substantial claim: may not pass S3 (load-bearing).

NIST FIPS 199 specifies that systems are categorized as low impact, moderate impact, or high impact for the security objectives of confidentiality, integrity, and availability.

“One approach is based on NIST FIPS 199 [FIPS199], which specifies that systems are categorized as low impact, moderate impact, or high impact for the security objectives of confidentiality, integrity, and availability.”

• cites FIPS199Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Analog mechanisms can be used to observe the physical system state and provide operators with reliable data if digital readings are unavailable or corrupted.

“Analog mechanisms (e.g., meters, alarms) can also be used to observe the physical system state and provide operators with reliable data if digital readings are unavailable or corrupted.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Safety and security incidents can have negative impacts that last longer than other types of incidents on all stakeholders, including employees, shareholders, customers, and the communities in which an organization operates.

“Safety and security incidents can have negative impacts that last longer than other types of incidents on all stakeholders, including employees, shareholders, customers, and the communities in which an organization operates.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In a demanding OT environment, situations may arise that require a temporary deviation from the security policy in order to maintain the mission or goal of the OT system.

“In a demanding OT environment, situations may arise that require a temporary deviation from the security policy in order to maintain the mission or goal of the OT system.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

If there are not enough time and resources to properly secure the system before deployment, it is unlikely that security will be addressed at a later time.

“If there are not enough time and resources to properly secure the system before deployment, it is unlikely that security will be addressed at a later time.”

Probably not a substantial claim: may not pass S3 (load-bearing).

When an organization conducts a risk assessment that includes OT systems, there may be additional considerations that do not exist when assessing the risks of traditional IT systems.

“When the organization conducts a risk assessment that includes OT systems, there may be additional considerations that do not exist when assessing the risks of traditional IT systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

ISA 62443-3-2 provides example definitions for determining a system categorization utilizing OT impacts.

“Another approach that is based on ISA 62443-3-2 [ISA62443] provides example definitions for determining a system categorization utilizing OT impacts.”

• cites ISA62443Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based).

Security countermeasures are typically developed for IT environments.

“Since security countermeasures are typically developed for IT environments, organizations should consider how deploying security technologies into OT environments may negatively impact operations or safety.”

Probably not a substantial claim: may not pass S3 (load-bearing).

NIST SP 800-30, Rev. 1 provides guidance for organizations to develop likelihood weighted risk factors.

“NIST SP 800-30, Rev. 1 [SP800-30r1] provides guidance for organizations to develop likelihood weighted risk factors.”

• cites SP800-30r1Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

OT systems often have specific environmental requirements or are tied to their physical environment for operations.

“OT systems often have specific environmental requirements (e.g., a manufacturing process may require a precise temperature), or they may be tied to their physical environment for operations.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Non-digital control mechanisms may depend on human response times, which may be slower than automated controls.

“Such mechanisms may also depend on human response times, which may be slower than automated controls.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Modern monitoring platforms that leverage native protocol communications to access more system information may improve awareness, but the limitations of these OT systems must be understood.

“Modern monitoring platforms that leverage native protocol communications to access more system information may improve awareness, but the limitations of these OT systems must be understood.”

Probably not a substantial claim: may not pass S2 (checkable).

The integration of control engineering and IT cultures will be essential for the development of a collaborative security design and operation.

“their integration will be essential for the development of a collaborative security design and operation.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Many OT system monitoring capabilities leverage passive monitoring techniques to detect system changes.

“Many OT system monitoring capabilities leverage passive monitoring techniques to detect system changes.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The effectiveness of an OT cybersecurity program is often enhanced through coordination or integration with the organization's processes and information security program.

“The effectiveness of an OT cybersecurity program is often enhanced through coordination or integration with the organization's processes and information security program.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Compensatory measures may be an effective solution to securing an OT system without affecting system performance.

“Compensatory measures may be an effective solution to securing an OT system without affecting system performance.”

Classified as probably not a substantial claim.

Information security programs typically focus on the confidentiality, integrity, and availability in that order for the entire organization.

“Information security programs typically focus on the confidentiality, integrity, and availabilityin that order -of information for the entire organization.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Threats may be difficult to accurately predict, even with historical data.

“By their nature, threats may be difficult to accurately predict, even with historical data.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Major accident hazards and the loss of containment due to equipment failure or operator mistakes can have serious consequences.

“From a safety perspective, major accident hazards and the loss of containment due to equipment failure or operator mistakes can have serious consequences.”

Probably not a substantial claim: may not pass S4 (based).

OT systems can also be used as an entry point to organizational IT systems and other enterprise systems.

“OT systems can also be used as an entry point to organizational IT systems and other enterprise systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Manual control mechanisms allow operators to manually control an actuator without relying on the digital OT system.

“Manual control mechanisms (e.g., manual valve controls, physical breaker switches) allow operators to manually control an actuator without relying on the digital OT system.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

The adoption of a cybersecurity strategy can assist an organization in understanding the life cycle of its OT systems and adjusting its approaches to maintaining security.

“The adoption of a cybersecurity strategy can assist an organization in understanding the life cycle of its OT systems and adjusting its approaches to maintaining security.”

• AssumptionRests on an assumption: OT assets often have long life cycles and reflect massive investments in operational, reliability, and safety testing.
• AssumptionRests on an assumption: It is sometimes neither economically nor technically feasible to replace existing OT equipment and applications wholesale with newer alternatives in the short- or medium-term.
• AssumptionRests on an assumption: OT equipment without the latest security features and updates is at greater risk of attacks than equipment with the latest versions.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The principles of defense in depth are flexible and can be applied to a wide range of OT environments, including ICS, SCADA, IoT, IIoT, and hybrid environments.

“Additionally, the principles of defense in depth are flexible and can be applied to a wide range of OT environments, including ICS, SCADA, Internet of Things (IoT), IIoT, and hybrid environments.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Utilizing separate networks allows for greater flexibility to address security and performance requirements between the two environments.

“Utilizing separate networks allows for greater flexibility to address security and performance requirements between the two environments.”

Probably not a substantial claim: may not pass S4 (based).

Allowing outbound connections from lower levels, tiers, or zones could represent a significant risk if unmanaged.

“Allowing outbound connections from lower levels, tiers, or zones could represent a significant risk if unmanaged.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The control selection process can be applied to OT from two perspectives: new development and legacy.

“The control selection process described in this section can be applied to OT from two perspectives: new development and legacy.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

As a result, the organization can ensure that cybersecurity goals are realized in its systems.

“As a result, the organization can ensure that cybersecurity goals are realized in its systems.”

Classified as probably not a substantial claim.

Supply-side organizations perform critical roles and functions, including manufacturing and provisioning technology products, providing software upgrades and patches, performing integration services, or otherwise supporting the day-to-day operations and maintenance of OT systems, components, and operational environments.

“These supply-side organizations perform critical roles and functions, including manufacturing and provisioning technology products, providing software upgrades and patches, performing integration services, or otherwise supporting the day-to-day operations and maintenance of OT systems, components, and operational environments.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Identifying, assessing, and effectively responding to cybersecurity risks in supply chains is best accomplished by incorporating cybersecurity supply chain risk management (C-SCRM) considerations into organizational policies, plans, and practices.

“Identifying, assessing, and effectively responding to cybersecurity risks in supply chains is best accomplished by incorporating cybersecurity supply chain risk management (C-SCRM) considerations into organizational policies, plans, and practices.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

In an OT environment, the physical and the digital are intertwined, and significant overlap may occur.

“However, in an OT environment, the physical and the digital are intertwined, and significant overlap may occur.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Existing systems may already support some or most of the security architecture strategy, so building on these existing capabilities could accelerate the strategy implementation.

“Organizations may also find that existing systems already support some or most of the security architecture strategy, so building on these existing capabilities could accelerate the strategy implementation.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

New OT environments provide an opportunity to evaluate cyber risk early on and build cybersecurity into the design.

“Additionally, new OT environments provide an opportunity to evaluate cyber risk early on and build cybersecurity into the design.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Since the systems already exist, organizations have likely completed the security categorization and security control selection processes, resulting in the establishment of previously agreed-upon controls in the respective security plans and the implementation of those controls within the systems.

“Since the systems already exist, organizations have likely completed the security categorization and security control selection processes, resulting in the establishment of previously agreed-upon controls in the respective security plans and the implementation of those controls within the systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The controls included in the security plans for the systems serve as security specifications and are expected to be incorporated into the systems during the development and implementation phases of the system development life cycle.

“The controls included in the security plans for the systems serve as security specifications and are expected to be incorporated into the systems during the development and implementation phases of the system development life cycle.”

Classified as probably not a substantial claim.

Cybersecurity risks can arise from the products or services acquired to support OT needs.

“Cybersecurity risks can arise from the products or services acquired to support OT needs.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The adoption of a cybersecurity strategy can result in a more systematic implementation of risk decisions into system development and operation.

“The adoption of a cybersecurity strategy can result in a more systematic implementation of risk decisions into system development and operation.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

A defense-in-depth strategy is particularly useful in OT environments because it can focus attention and defensive mechanisms on critical functions.

“A defense-in-depth strategy is particularly useful in OT environments because it can focus attention and defensive mechanisms on critical functions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In some cases, it may not be feasible to immediately mitigate the risk due to scheduling issues.

“In some cases, it may not be feasible to immediately mitigate the risk due to scheduling issues.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Changing the data collection point to capture network traffic before or after encryption could help improve monitoring capabilities when encrypted communication is expected.

“Changing the data collection point to capture network traffic before or after encryption (e.g., using host-based network monitoring tools) could help improve monitoring capabilities when encrypted communication is expected.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Critical infrastructure standards and requirements are typically designed to protect critical cyber assets to support reliability and may carry additional legal obligations.

“These standards and requirements are typically designed to protect critical cyber assets to support reliability and may carry additional legal obligations for the organization.”

Classified as probably not a substantial claim.

The existence of an architecture informed by a cybersecurity strategy increases the likelihood that high-level cybersecurity goals will be reflected in the cybersecurity of individual systems.

“The existence of an architecture informed by a cybersecurity strategy increases the likelihood that high-level cybersecurity goals will be reflected in the cybersecurity of individual systems.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Internet access, email, and remote access are typically permitted on corporate networks but not allowed on OT networks.

“For example, internet access, email, and remote access are typically permitted on the corporate network but not allowed on OT networks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The RMF steps, while shown sequentially, can be implemented in a different order to be consistent with established management and system development life cycle processes.

“The RMF steps in Fig. 15, while shown sequentially, can be implemented in a different order to be consistent with established management and system development life cycle processes.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

These risks have the potential to compromise the availability and integrity of critical OT systems and components, as well as the availability, integrity, and confidentiality of the data utilized by the OT, thereby causing harms that range from minor disruptions to impacts on life and safety.

“Whether they are malicious, natural, or unintentional, these risks have the potential to compromise the availability and integrity of critical OT systems and components, as well as the availability, integrity, and confidentiality of the data utilized by the OT, thereby causing harms that range from minor disruptions to impacts on life and safety.”

Probably not a substantial claim: may not pass S4 (based).

Programmatic and organizational decisions will guide and impact the decisions made for the other defense-in-depth layers.

“These programmatic and organizational decisions will guide and impact the decisions made for the other defense-in-depth layers.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A unidirectional gateway deployed between Layers 2 and 3 may protect Layer 0, 1, and 2 devices from a cybersecurity event that occurs at Layers 3, 4, or 5.

“For example, a unidirectional gateway deployed between Layers 2 and 3 may protect Layer 0, 1, and 2 devices from a cybersecurity event that occurs at Layers 3, 4, or 5.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The strategy provides a document and reminder of cybersecurity goals when decisions are being made at the system level.

“The strategy provides a document and reminder of those goals when decisions are being made at the system level.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The culture of safety and safety assessments is well established within much of the OT user community.

“The culture of safety and safety assessments is well established within much of the OT user community.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Grouping components into levels, tiers, or zones is a precursor activity before organizations can consider applying isolation devices to protect and monitor communications between levels, tiers, or zones.

“Whether using a risk-based approach, functional model, or other organizing principle, grouping components into levels, tiers, or zones is a precursor activity before organizations can consider applying isolation devices to protect and monitor communications between levels, tiers, or zones.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For new development systems, the control selection process is applied from a requirements definition perspective since the systems do not yet exist and organizations are conducting initial security categorizations.

“For new development systems, the control selection process is applied from a requirements definition perspective since the systems do not yet exist and organizations are conducting initial security categorizations.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Tools and capabilities that support BAD, SIEM, IDS, and IPS can assist organizations with monitoring traffic throughout the network and generate alerts when they identify anomalous or suspicious traffic.

“Tools and capabilities that support behavior anomaly detection (BAD), security information and event management (SIEM), intrusion detection systems (IDS), and intrusion prevention systems (IPS) can assist organizations with monitoring traffic throughout the network and generate alerts when they identify anomalous or suspicious traffic.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

As a result, adversaries may find it increasingly difficult to penetrate the environment without detection.

“As a result, adversaries may find it increasingly difficult to penetrate the environment without detection.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Safety systems may reduce the impact of a cyber incident on the OT and are often deployed to perform specific monitoring and control functions to ensure the safety of people, the environment, processes, and assets.

“Safety systems may reduce the impact of a cyber incident on the OT and are often deployed to perform specific monitoring and control functions to ensure the safety of people, the environment, processes, and assets.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Overlays are intended to reduce the need for ad hoc tailoring of baselines by organizations through the selection of a set of controls and control enhancements that more closely correspond to common circumstances, situations, and/or conditions.

“In general, overlays are intended to reduce the need for ad hoc tailoring of baselines by organizations through the selection of a set of controls and control enhancements that more closely correspond to common circumstances, situations, and/or conditions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The NIST Risk Management Framework (RMF) applies the risk management process and concepts to systems and organizations.

“The NIST Risk Management Framework (RMF) applies the risk management process and concepts (i.e., framing risk, assessing risk, responding to risk, and monitoring risk) to systems and organizations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Prepare step leverages activities that are already being conducted within cybersecurity programs to emphasize the importance of having organization-wide governance and resources in place to support risk management.

“The Prepare step leverages activities that are already being conducted within cybersecurity programs to emphasize the importance of having organization-wide governance and resources in place to support risk management.”

Probably not a substantial claim: may not pass S3 (load-bearing).

NIST SP 800-53A provides guidance for assessing selected controls from NIST SP 800-53 to ensure that they are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements of the system.

“NIST SP 800-53A [SP800-53Ar5] provides guidance for assessing selected controls from NIST SP 800-53 to ensure that they are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements of the system.”

• cites SP800-53Ar5Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

A comprehensive and accepted cybersecurity strategy can assist an organization with consistently maintaining acceptable risk management throughout the life cycle of an OT system.

“A comprehensive and accepted cybersecurity strategy can assist an organization with consistently maintaining acceptable risk management throughout the life cycle of an OT system.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A centralized log management platform can assist organizations with supporting log retention, monitoring, and analysis efforts.

“A centralized log management platform can assist organizations with supporting log retention, monitoring, and analysis efforts.”

Probably not a substantial claim: may not pass S3 (load-bearing).

NIST SP 800-53B identifies the recommended control baselines for federal systems and information.

“NIST SP 800-53B [SP800-53B] identifies the recommended control baselines for federal systems and information.”

• cites SP800-53BNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

The use of overlays does not preclude organizations from performing further tailoring.

“The use of overlays does not in any way preclude organizations from performing further tailoring (i.e., overlays can also be subject to tailoring) to reflect organization-specific needs, assumptions, or constraints.”

Probably not a substantial claim: may not pass S4 (based).

With few exceptions, organizations that are responsible for OT rely upon suppliers, other third-party providers, and their extended supply chains for a range of needs.

“With few exceptions, organizations that are responsible for OT rely upon suppliers, other thirdparty providers, and their extended supply chains for a range of needs.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Cybersecurity defenses are not static and require changes and updates as risks change for the environment.

“Additionally, cybersecurity defenses are not static and require changes and updates as risks change for the environment.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Implementing network segmentation utilizing levels, tiers, or zones allows organizations to control access to sensitive information and components while also considering operational performance and safety.

“Implementing network segmentation utilizing levels, tiers, or zones allows organizations to control access to sensitive information and components while also considering operational performance and safety.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The strategy provides a framework for incorporating desired system characteristics into the final systems.

“The strategy provides a framework for incorporating those characteristics into the final systems.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

An OT-specific continuous monitoring strategy to measure control effectiveness may be necessary due to unique operational, environmental, and/or availability constraints.

“An OT-specific continuous monitoring strategy to measure control effectiveness may be necessary due to unique operational, environmental, and/or availability constraints.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Of the three security objectives, availability is generally the greatest concern for an OT.

“Of the three security objectives, availability is generally the greatest concern for an OT.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

A BAD system or IDS may be unable to determine whether encrypted network communication is malicious and could generate false positive or negative alerts for the traffic.

“For example, a BAD system or IDS may be unable to determine whether encrypted network communication is malicious and could generate false positive or negative alerts for the traffic.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For legacy systems, the security control selection process is applied from a gap analysis perspective when organizations anticipate significant changes to the systems.

“In contrast, the security control selection process for legacy systems is applied from a gap analysis perspective when organizations anticipate significant changes to the systems (e.g., during major upgrades, modifications, or outsourcing).”

Probably not a substantial claim: may not pass S4 (based).

Combining control and safety could allow a sophisticated attacker access to both control and safety systems if the OT were compromised.

“Combining control and safety could allow a sophisticated attacker access to both control and safety systems if the OT were compromised.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The use of unidirectional gateways may provide additional protections associated with system compromises at higher levels or tiers within the environment.

“The use of unidirectional gateways may provide additional protections associated with system compromises at higher levels or tiers within the environment.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Utilizing the principles of a defense-in-depth architecture to systematically layer security controls can help organizations strengthen their overall cybersecurity defenses.

“Utilizing the principles of a defense-in-depth architecture to systematically layer security controls -including people, processes, and technology -can help organizations strengthen their overall cybersecurity defenses.”

Classified as probably not a substantial claim.

The nature of network traffic on corporate and OT networks is different.

“The nature of network traffic on these two network types is different.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Safety assessments are primarily concerned with the physical world, while information security risk assessments consider the digital world.

“Safety assessments are primarily concerned with the physical world, while information security risk assessments consider the digital world.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

System security is optimized by engineering design based on a proactive loss prevention strategy.

“System security is optimized by engineering design that is based on a proactive loss prevention strategy.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

While safety systems are traditionally implemented to be fully redundant and independent from the primary OT, some architectures combine control and safety functions, components, or networks.

“While these systems are traditionally implemented to be fully redundant and independent from the primary OT, some architectures combine control and safety functions, components, or networks.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Defense in depth requires an integration of people, processes, and technology to be effective.

“Defense in depth requires an integration of people, processes, and technology to be effective.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The standards and guidance for the categorization process can be found in FIPS 199 and NIST SP 800-60.

“The standards and guidance for this categorization process can be found in FIPS 199 [FIPS199] and NIST SP 800-60 [SP800-60v1r1][SP800-60v2r1], respectively.”

• cites FIPS199Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites SP800-60v1r1Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites SP800-60v2r1Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The control baselines are the starting point for the control selection process and are chosen based on the security category and associated impact level of the systems identified in the Categorize step.

“The control baselines are the starting point for the control selection process and are chosen based on the security category and associated impact level of the systems identified in the Categorize step.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The adoption of a security architecture strategy may be impacted by the current state of existing OT environments.

“As a result, the adoption of a security architecture strategy may be impacted by the current state of existing OT environments.”

Classified as probably not a substantial claim.

When properly configured, network architectures support segmentation and isolation by enforcing security policies and controlling network communications.

“When properly configured, network architectures support segmentation and isolation by enforcing security policies and controlling network communications.”

Probably not a substantial claim: may not pass S4 (based).

These risks can be introduced anywhere in the supply chain and at any stage in the life cycle.

“These risks can be introduced anywhere in the supply chain and at any stage in the life cycle.”

Probably not a substantial claim: may not pass S3 (load-bearing).

By consciously choosing to develop and implement a cybersecurity strategy, an organization establishes a disciplined approach that considers all aspects of the system life cycle with cybersecurity in mind.

“By consciously choosing to develop and implement a cybersecurity strategy, an organization establishes a disciplined approach that considers all aspects of the system life cycle -from procurement to decommissioning -with cybersecurity in mind.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Knowing the advantages and disadvantages of encryption can help organizations make an informed decision on where to include encryption in the defense-in-depth strategy.

“Knowing the advantages and disadvantages of encryption can help organizations make an informed decision on where to include encryption in the defense-in-depth strategy.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Some regulations, such as NERC CIP-006-5 or from the Nuclear Regulatory Commission (NRC), may determine the strength and quantity of barriers used for the physical protection of a facility.

“Some regulations, such as NERC CIP-006-5 (Physical Security of BES Cyber Systems) or from the Nuclear Regulatory Commission (NRC), may also determine the strength and quantity of barriers used for the physical protection of a facility.”

• cites NERC CIP-006-5Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites NRCNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Because encryption and decryption use algorithms to create ciphers, encryption adds latency and may not be suitable for all OT devices.

“Because encryption and the subsequent decryption process use algorithms to create ciphers, encryption adds latency and may not be suitable for all OT devices.”

Classified as probably not a substantial claim.

Correlating events across multiple OT devices can be difficult if the event timestamps generated by the devices were not informed by a shared time source.

“Correlating events across multiple OT devices can be difficult if the event timestamps generated by the devices were not informed by a shared time source.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Critical data may include personally identifiable information and sensitive, proprietary, or trade secret information (e.g., PLC program code, robot programs, CAD/CAM files, operating manuals and documentation, electrical diagrams, network diagrams, historical production data).

“This may include personally identifiable information and sensitive, proprietary, or trade secret information (e.g., PLC program code, robot programs, computer-aided drafting [CAD] or computer-aided manufacturing [CAM] files, operating manuals and documentation, electrical diagrams, network diagrams, historical production data [IR8183A]).”

• cites IR8183ANot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Other tools, such as bump-in-the-wire security devices, can be installed in line with devices that cannot be updated or are using obsolete operating systems.

“Other tools, such as bump-in-the-wire security devices, can be installed in line with devices that cannot be updated or are using obsolete operating systems.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

If a device or system clock is inaccurate, the timestamps generated by the clock for event and log entries will also be inaccurate, as well as any other functions that utilize the clock.

“If a device or system clock is inaccurate, the timestamps generated by the clock for event and log entries will also be inaccurate, as well as any other functions that utilize the clock.”

May combine two claims.

Federal organizations are required to comply with FIPS 140-3 and the Cryptographic Module Validation Program (CMVP).

“Federal organizations are required to comply with FIPS 140-3 [FIPS140-3] and the Cryptographic Module Validation Program (CMVP).”

• cites FIPS140-3Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

One regional Amtrak train from Richmond, Virginia, to Washington and New York was delayed for more than two hours.

“one regional Amtrak train from Richmond, Virginia, to Washington and New York was delayed for more than two hours.”

• cites http://www.informationweek.com/story/showArticle.jhtml?articleID=13100807Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Long-distance trains were also delayed between four and six hours.

“Long-distance trains were also delayed between four and six hours.”

• cites http://www.informationweek.com/story/showArticle.jhtml?articleID=13100807Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In the spring of 2000, a former employee of an Australian manufacturing software organization used a radio transmitter on as many as 46 occasions over two months to remotely break into the controls of a sewage treatment system, altered electronic data for sewerage pumping stations, caused malfunctions, and released about 264,000 gallons of raw sewage into nearby rivers and parks.

“Over a two-month period, the disgruntled employee reportedly used a radio transmitter on as many as 46 occasions to remotely break into the controls of a sewage treatment system.He altered electronic data for particular sewerage pumping stations and caused malfunctions in their operations, ultimately releasing about 264,000 gallons of raw sewage into nearby rivers and parks.”

• cites [11] 11. Building an OT Cybersecurity Business Case .........................................................35Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based).

Anomalous behavior on shared accounts may be more difficult to determine.

“Anomalous behavior on shared accounts may be more difficult to determine”

• AssumptionRests on an assumption: Shared credentials are often used on OT systems.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

McAfee reported a series of attacks designed to steal sensitive data from global oil, energy, and petrochemical industries, in which adversaries exfiltrated proprietary operations data and project financing information regarding oil and gas field bids and operations.

“McAfee reported a series of attacks that were designed to steal sensitive data from global oil, energy, and petrochemical industries.Adversaries exfiltrated proprietary operations data and project financing information with regard to oil and gas field bids and operations.”

• cites McAfeeNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

The capability to disconnect or disable remote access is critical to managing risk and may be required to provide stable and safe operations.

“Rationale for adding AC-17 ( 9) to LOW, MOD, and HIGH baselines: As more OT systems become accessible remotely, the capability to disconnect or disable remote access is critical to managing risk and may be required to provide stable and safe operations.”

• AssumptionRests on an assumption: More OT systems are becoming accessible remotely.

Probably not a substantial claim: may not pass S3 (load-bearing).

ISA 62443-3-2 provides guidance on how to assess cyber risk in an environment with these potential consequences.

“ISA 62443-3-2 provides guidance on how to assess cyber risk in an environment with these potential consequences.”

• cites ISA 62443-3-2Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Using a diverse set of suppliers in the OT environment can improve reliability by reducing common cause failures.

“Using a diverse set of suppliers in the OT environment can improve reliability by reducing common cause failures.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Safety considerations may require that an organization use physical separation as opposed to logical separation.

“For example, safety considerations may require that an organization use physical separation as opposed to logical separation.”

Probably not a substantial claim: may not pass S4 (based).

OT functionality is generally defined in advance and does not change often.

“Rationale for adding SC-41 to LOW, MOD, and HIGH baselines: OT functionality is generally defined in advance and does not change often.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Shutting down and restarting the OT (or ICS) may not always be feasible upon the identification of an anomaly.

“Shutting down and restarting the OT may not always be feasible upon the identification of an anomaly.”

• Also stated in: § Additional information · hedged

  “Shutting down and restarting the ICS may not always be feasible upon identification of an anomaly.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The energy sector was targeted during a multiyear cyber-espionage campaign that primarily used Havex malware; Havex was a remote access Trojan that used the Open Platform Communications (OPC) standard to gather information about connected ICS devices on a network; the campaigns were exploratory.

“The energy sector was targeted during a multiyear cyber-espionage campaign that primarily used Havex malware.Havex was a remote access Trojan that used the Open Platform Communications (OPC) standard to gather information about connected ICS devices on a network.The campaigns were exploratory.”

• cites [17] 17. Define the OT Cybersecurity Strategy .....................................................................39Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Trains between Pittsburgh, PA, and Florence, South Carolina, were halted because of dark signals.

“Trains between Pittsburgh, PA, and Florence, South Carolina, were halted because of dark signals”

• cites http://www.informationweek.com/story/showArticle.jhtml?articleID=13100807Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based).

The loss of availability, integrity, and confidentiality of certain types of information that reside on a high-impact OT system may result in severe or catastrophic adverse effects on operations, assets, or individuals, including severe degradation or loss of mission capability, major damage to organizational assets, or harm to individuals involving the loss of life or life-threatening injuries.

“The loss of availability, integrity, and confidentiality of certain types of information that reside on a high-impact OT system may result in severe or catastrophic adverse effects on operations, assets, or individuals, including severe degradation or loss of mission capability, major damage to organizational assets, or harm to individuals involving the loss of life or life-threatening injuries.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Organizations can help industries move toward more secure products by requesting secure code development practices in their service-level agreements and procurement actions.

“Organizations can help industries move toward more secure products by requesting these practices in their service-level agreements and procurement actions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In 2014, hackers manipulated and disrupted control systems to such a degree that a blast furnace could not be properly shut down, resulting in unspecified 'massive' damage.

“In 2014, hackers manipulated and disrupted control systems to such a degree that a blast furnace could not be properly shut down, resulting in unspecified”

• cites [14] 14. OT Cybersecurity Program Content ...........................................................................37Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Code authentication provides assurance that the software and firmware have not been tampered with.

“Code authentication provides assurance that the software and firmware have not been tampered with.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Stuxnet was a Microsoft Windows computer worm discovered in July 2010 that specifically targeted industrial software and equipment; it initially spread indiscriminately but included a highly specialized malware payload designed to only target particular SCADA systems configured to control and monitor specific industrial processes.

“Stuxnet was a Microsoft Windows computer worm discovered in July 2010 that specifically targeted industrial software and equipment.The worm initially spread indiscriminately but included a highly specialized malware payload that was designed to only target particular SCADA systems that were configured to control and monitor specific industrial processes.”

• cites [13] 13. Presenting the OT Cybersecurity Business Case to Leadership ..............................36Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The relatively static nature of OT environments presents an opportunity for organizations to include application allowlisting as part of their defense-in-depth strategy and is a recommended best practice by DHS.

“The relatively static nature of OT environments presents an opportunity for organizations to include application allowlisting as part of their defense-in-depth strategy and is a recommended best practice by DHS.”

• cites DHSNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The Sobig virus infected the computer system at CSX Corp.'s Jacksonville, Florida, headquarters and shut down signaling, dispatching, and other systems.

“The virus infected the computer system at CSX Corp.'s Jacksonville, Florida, headquarters and shut down signaling, dispatching, and other systems.”

• cites http://www.informationweek.com/story/showArticle.jhtml?articleID=13100807Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Encryption can negatively impact other defense tools, such as network monitoring.

“Organizations must also consider that encryption can negatively impact other defense tools, such as network monitoring.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Patch management is a defense-in-depth capability that supports vulnerability management as part of an organizational risk management strategy.

“As a result, patch management is a defense-in-depth capability that supports vulnerability management as part of an organizational risk management strategy.”

• AssumptionRests on an assumption: Patches have two main purposes: to address vulnerabilities and to enhance functionality.
• AssumptionRests on an assumption: In the context of defense-in-depth software security, patching is associated with reducing vulnerabilities.

Classified as probably not a substantial claim.

Unauthorized or accidental access to the OT environment could affect the physical process.

“Rationale for adding IA-12 (1) to HIGH baseline: A supervisor or sponsor should be made aware of any access that an employee has to the OT environment since unauthorized or accidental access could affect the physical process.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Utilizing multiple time sources can benefit OT devices by reducing clock error and providing backup time sources if the primary time source is lost or if the time quality of a primary time source has degraded.

“Utilizing multiple time sources can benefit OT devices by reducing clock error and providing backup time sources if the primary time source is lost or if the time quality of a primary time source has degraded.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Many OT systems use legacy components that cannot meet modern supply chain expectations.

“Many OT systems use legacy components that cannot meet modern supply chain expectations.”

Probably not a substantial claim: may not pass S2 (checkable).

The ability to authenticate remote commands is important to prevent unauthorized commands that may have immediate or serious consequences, such as injury, death, property damage, the loss of high-value assets, the failure of mission or business functions, or compromise of sensitive information.

“Rationale for adding AC-17 (10) to MOD and HIGH baselines: The ability to authenticate remote commands is important to prevent unauthorized commands that may have immediate or serious consequences, such as injury, death, property damage, the loss of high-value assets, the failure of mission or business functions, or compromise of sensitive information.”

Classified as probably not a substantial claim.

As a result, a ZTA implementation might not be practical for some OT devices.

“As a result, a ZTA implementation might not be practical for some OT devices.”

• AssumptionRests on an assumption: Some OT components may not support the technologies or protocols required to fully integrate with a ZTA implementation.

Probably not a substantial claim: may not pass S4 (based).

An IDS might not be able to determine whether an encrypted packet is malicious, resulting in either false-positive or false-negative alerts.

“For example, an IDS might not be able to determine whether an encrypted packet is malicious, resulting in either false-positive or false-negative alerts.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Adversaries may steal operational information for personal gain or to inform future operations.

“Adversaries may steal operational information for personal gain or to inform future operations.”

• cites ATTACK-ICSNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

CISA serves as a centralized location where operational elements involved in cybersecurity and communications reliance are coordinated and integrated.

“CISA serves as a centralized location where operational elements involved in cybersecurity and communications reliance are coordinated and integrated.”

Classified as probably not a substantial claim. May combine two claims.

Depending on the frequency of events being logged, the log size may grow quickly and result in increasing space utilization.

“Depending on the frequency of events being logged, the log size may grow quickly and result in increasing space utilization.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

If the site has an emergency generator, the UPS battery life may only need to last for a few seconds; if the site relies on external power, the UPS battery life may need to last for hours.

“If the site has an emergency generator, the UPS battery life may only need to last for a few seconds.However, if the site relies on external power, the UPS battery life may need to last for hours.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In 2013, an Iranian computer security company obtained remote access to a computer that controlled the SCADA system for the Bowman Dam in Rye, New York; the adversary viewed water levels, temperature, and the status of the sluice gate; the sluice gate control was disconnected for maintenance at the time, so the dam could not be remotely controlled.

“In 2013, an Iranian computer security company obtained remote access to a computer that controlled the SCADA system for the Bowman Dam located in Rye, New York.The adversary was able to view water levels, temperature, and the status of the sluice gate.The sluice gate control was disconnected for maintenance at the time of adversarial remote access, so the dam could not be remotely controlled.”

• cites [16] 16. Build and Train a Cross-Functional Team to Implement the OT Cybersecurity Program ..................................................................................................................38Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Encryption, digital signatures, hashing, and other cryptographic functions are available to prevent unauthorized access or the modification of data at rest and in transit.

“Encryption, digital signatures, hashing, and other cryptographic functions are available to prevent unauthorized access or the modification of data at rest and in transit [RFC4949].”

• cites RFC4949Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

According to Amtrak spokesman Dan Stessel, 10 Amtrak trains were affected in the morning.

“According to Amtrak spokesman Dan Stessel, 10 Amtrak trains were affected in the morning.”

• cites http://www.informationweek.com/story/showArticle.jhtml?articleID=13100807Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

The PM-17 control applies to federal agencies and other organizations that support the Government and process controlled unclassified information (CUI).

“This control applies to federal agencies and other organizations that support the Government and process controlled unclassified information (CUI).”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When properly configured, non-authorized applications will not execute on the host environment.

“When properly configured, non-authorized applications will not execute on the host environment.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Many OT systems use information diversity in their design to achieve reliability requirements.

“Many OT systems use information diversity in their design to achieve reliability requirements.”

Probably not a substantial claim: may not pass S4 (based).

Without authentication, there is the potential to replay, modify, or spoof data.

“Without authentication, there is the potential to replay, modify, or spoof data.”

• AssumptionRests on an assumption: Many of the devices and the communication protocols at the Field I/O level (Purdue Level 0) cannot be authenticated.

Probably not a substantial claim: may not pass S3 (load-bearing).

NERC Standard CIP-005 provides cybersecurity architecture requirements for bulk electric systems.

“For example, NERC Standard CIP-005 (see Appendix D.1.9)provides cybersecurity architecture requirements for bulk electric systems.”

• cites Appendix D.1.9Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Some tools, such as WAF and IPS, could be configured to provide additional protection to detect or prevent attacks against unpatched vulnerabilities while the organization waits for an opportunity to apply the updates.

“Some tools, such as web application firewalls (WAF) and IPS, could be configured to provide additional protection to detect or prevent attacks against unpatched vulnerabilities while the organization waits for an opportunity to apply the updates.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In August 2003, the Sobig computer virus was blamed for shutting down train signaling systems throughout the East Coast of the U.S.

“In August 2003, the Sobig computer virus was blamed for shutting down train signaling systems throughout the East Coast of the U.S.”

• cites http://www.informationweek.com/story/showArticle.jhtml?articleID=13100807Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

A common architecture for supporting a defense-in-depth cybersecurity approach involves the use of network segmentation or zoning to organize devices by location or function.

“As discussed in Section 5, a common architecture for supporting a defense-in-depth cybersecurity approach involves the use of network segmentation or zoning to organize devices by location or function.”

• cites Section 5Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In 2012, Saudi Aramco experienced a malware attack that targeted their refineries and overwrote the attacked systems' master boot records (MBRs), partition tables, and other data files, causing the systems to become unusable.

“In 2012, Saudi Aramco experienced a malware attack that targeted their refineries and overwrote the attacked systems' master boot records (MBRs), partition tables, and other data files.This caused the systems to become unusable.”

• cites [15] 15. Establish OT Cybersecurity Governance .................................................................38Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.